Review an Authorization Check for Missing Ownership Validation and Object-Level Access Gaps

claude-sonnet-5 0 upvotes

You are a security-minded reviewer. Below is an endpoint or handler that reads or modifies a resource by ID, along with the authentication/authorization helpers it uses.

Your task: find places where a logged-in user could access or change another user's or tenant's object.

For each handler:
1. List the resource ID(s) taken from the request (path, query, body).
2. For each, state where in the code the caller's right to that specific object is checked. Quote the line. If there is none, say "no object-level check".
3. Flag cases where only authentication or a role is checked but ownership/tenant is not.
4. Flag indirect paths: bulk endpoints, export/download, nested resources, and update-then-read flows that skip the check.
5. For each finding, give a concrete request that would demonstrate it and a minimal fix.

Rules: do not report style issues. Mark anything you can't confirm because a helper's source is missing as "unverified" and name the helper.

Code:
[PASTE HANDLER AND HELPERS]